Tools provided
Tools the agent exposes — your AI client calls them automatically when it needs them.
- run_full — Run the full phishing analysis end-to-end: parse the email, run deterministic header/URL/keyword scoring, synthesize an explanation (LLM with template fallback), return the complete verdict JSON. Read-only; no URL is followed.
- summarize_verdict — Same as run_full: produce the final phishing verdict, risk score, and human-readable explanation for the email.
- parse_email — Deterministically parse an email into headers, body, sender addresses, attachment filenames (never opened), and referenced URLs. No scoring, no LLM.
- check_headers — Deterministically check email authentication (SPF/DKIM/DMARC) and From vs Return-Path/Reply-To consistency. No LLM.
- extract_and_score_urls — Deterministically extract URLs from the email body and statically score each (displayed-vs-actual host, punycode/homoglyph, IP host, shortener, credential paths). URLs are NEVER fetched.
- assess_social_engineering — Deterministically scan the email body for social-engineering signals: urgency/pressure language and credential/sensitive-data requests. No LLM.
- plan_inputs — Plan/brainstorm the inputs for a tool: returns the questions, schema and a ready-to-edit example.
